destroying user IdP session as part of profile intercept flow

[Scott Koranda]

> > Preventing SSO in the future via that result is precisely what
> > I want to do for this use case. Thanks.
> 
> Ok. Is that really the goal, or is this more of a
> programmatic "disable SSO" case, like with a shared machine
> or something?

It really is the goal.

I do not, however, see the strategy of removing an active authentication
result working.

The intercept flow includes this:

<action-state id="RemoveAuthenticationResult">
     <on-entry>
         <evaluate expression="opensamlProfileRequestContext.getSubcontext(T(net.shibboleth.idp.authn.context.SubjectContext))" result="flowScope.subjectContext" />
         <evaluate expression="subjectContext.getAuthenticationResults()" result="flowScope.authenticationResults"/>
         <evaluate expression="T(org.slf4j.LoggerFactory).getLogger('net.shibboleth.idp.authn').debug('BEFORE {}', authenticationResults.keySet())" />
         <evaluate expression="authenticationResults.remove('authn/Myflow')"/>
         <evaluate expression="T(org.slf4j.LoggerFactory).getLogger('net.shibboleth.idp.authn').debug('AFTER {}', authenticationResults.keySet())" />
     </on-entry>

     <evaluate expression="'proceed'"/>
     <transition on="proceed" to="MyEndState"/>
</action-state>

In the log I see that the active authentication results BEFORE are

[authn/Password, authn/Myflow]

and AFTER

[authn/Password]

as I expect.

But when I go back to the SP and SSO is attempted I also see in the log

DEBUG [net.shibboleth.idp.authn.impl.SelectAuthenticationFlow:350] - Profile Action SelectAuthenticationFlow: Reusing active result authn/Myflow

I expected that since I removed the authentication result with flow ID 'authn/Myflow'
from the active authentication results for the subject then it could not possibly
be reused.

What am I missing?

Thanks,

Scott K